o j@s|ddlZddlZddlZddlZddlZddlZddlZddlZddlm Z m Z m Z ddl m mZddlmZddlmZddlmZmZddlmZddlmZmZmZddlmZmZdd l m!Z!dd l"m#Z$dd l%m&Z&m'Z'm(Z(dd l)m*Z*dd l+m,Z,m-Z-ddl.m/Z/m0Z0ddl1m2Z2e34dkrddl5m6Z6 GdddZ7gddfddZ8ddZ9e:dkre9dSdS)N)sha1 pbkdf2_hmacsha512)logger) MasterKeyFile)CredentialFileCREDENTIAL_BLOB) DPAPI_BLOB) VAULT_VCRD VAULT_VPOLVAULT_VPOL_KEYS)NGCProtectorFinder NGCProtector)CryptoKeysFinder)md4)AESMODE_GCMMODE_CBC)PVKFile)CryptoAPIKeyFileCryptoAPIKeyProperties)UniversalEncoderbase64_decode_url)PKCS1v15windows)ProcessManipulatorc@s eZdZdoddZdpddZddZd d Zdpd d Zd dZdqddZ ddZ ddZ dpddZ ddZ ddZddZddZdpdd Zdrd"efd#d$Zdpd%d&Zd'd(Zd)d*Zdpd+d,Zdsd-d.Zdsd/d0Zd1d2Zd3d4Zd5d6Zdpd7d8Zd9d:Zdpd;d<Zd=d>Z d?d@Z!e"dAdBZ#e"dCdDZ$e"dEdFZ%e"dGdHZ&e"dIdJZ'e"dKdLZ(e"dMdNZ)e"dOdPZ*dQdRZ+dodSdTZ,dUdVZ-e"dWdXZ.e"dYdZZ/e"d[d\Z0e"dtd^e1fd_d`Z2dadbZ3dcddZ4dedfZ5e"dgdhZ6didjZ7dkdlZ8dmdnZ9dS)uDPAPIFcCs"||_i|_i|_i|_g|_dSN) use_winapiprekeys masterkeys backupkeys vault_keys)selfrr$/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/dpapi/dpapi.py__init__is  zDPAPI.__init__NcCsv|dur|jD]}t|qdSt|ddd}|jD] }||dqWddS1s4wYdS)Nwnewlinez )rprinthexopenwrite)r#filenamexfr$r$r% dump_pre_keysus  "zDPAPI.dump_pre_keysc Cszt|dWnty$}zt|}d|j|<WYd}~dSd}~wwt|d}|D]}|}d|jt|<q-WddS1sGwYdS)Nr)r- Exceptionbytesfromhexrstrip)r#r/ekeyr1liner$r$r% load_prekeys~s   "zDPAPI.load_prekeyscCs`ddlm}t|d}|dd}Wdn1swY||d}td|dS)Nr)UUIDrb)bytes_lez [GUID] %s)uuidr=r-readr+)r#r/r=r1bguidr$r$r%dump_preferred_masterkey_guids   z#DPAPI.dump_preferred_masterkey_guidc Cs|dur,|jD]}td||j|fq|jD]}td||j|fqdSt|ddd}|j|jd}|tj|tddd WddS1sRwYdS) Nz[GUID] %s [MASTERKEY] %sz[GUID] %s [BACKUPKEY] %sr'r(r))r r!T)clsindent sort_keys) r r+r,r!r-r.jsondumpsr)r#r/r0r1tr$r$r%dump_masterkeyss  "zDPAPI.dump_masterkeyscCst|d}t|}Wdn1swY|dD]}t|d||j|<q |dD]}t|d||j|<q3dS)Nr3r!r )r-rJloadsrBr6r7r!r )r#r/r1datarDr$r$r%load_masterkeyss   zDPAPI.load_masterkeysc Cs|dur|dur|durtd|dur,|r t|tr t|}|r,t|tr,t|}d}}}}|s:|dkrNt|d} | }t|d}|r`t ||ddt}|}|rt ||ddt}t d||dd} t d| |dddd } t | |ddtdd }d} ||||fD]} | durd|j | <t d | |||| f| d7} q||||fS) a Creates pre-masterkeys from user SID and password of nt hash. If NT hash is provided the function can only generate 2 out of the 3 possible keys, this is because one of the derived keys relies ion the SHA1 hash of the user password sid: user's SID as a string password: user's password. optional. if not provided, then NT hash must be provided nt_hash: user's NT hash. optional if not provided, the password must be provided Nz.Provide either password, NT hash or SHA1 hash!r(zutf-16lesha256i'r4r?zPrekey_%d %s %s %s %s)r5 isinstancestrr6r7MD4encodedigestrhmacnewrrrdebugr,)r#sidpasswordnt_hash sha1_hashkey1key2key3key4ctxtmp_key tmp_key_2countr:r$r$r%get_prekeys_from_passwords6    $   zDPAPI.get_prekeys_from_passwordc Cs g}g}ddlm}ddlm}|jrI|jjD]1}t|||frHtd|jtd|j d|j |j<| |jd|j |j <| |j q|j dur|j j D]/}|jrd|j j|jf}|j||jd\}} } } td || | f| | | | qRqR||fS) a Gets the pre-keys from an already parsed OffineRegistry or LiveRegistry object, populates the userkey/machinekey lists, returns the obtained keys lr: OffineRegistry or LiveRegistry object return: touple of two lists, [0] userkeys [1] machinekeys r)LSASecretDPAPIz1[DPAPI] Found DPAPI user key in registry! Key: %sz4[DPAPI] Found DPAPI machine key in registry! Key: %sr4Nz%s-%s)r^zJ[DPAPI] NT hash method. Calculated user key for user %s! Key2: %s Key3: %s)!pypykatz.registry.security.commonri"pypykatz.registry.security.acommonsecuritycached_secretsrTrr[user_key machine_keyrappendsamsecretsr^ machine_sidridrh) r#lrusermachineriALSASecretDPAPIsecretr\r0rarbyr$r$r%get_registry_secretss2           zDPAPI.get_registry_secretsc Csddlm}ddlm}d}z|}Wn5tyI}z)tdz|}Wnty>}z tdWYd}~nd}~wwWYd}~nd}~ww|durS| |Std)B return: touple of two lists, [0] userkeys [1] machinekeys r) LiveRegistryOffineRegistryNzL[DPAPI] Failed to obtain registry secrets via direct registry reading methodz=[DPAPI] Failed to obtain registry secrets via filedump methodzRegistry parsing failed!) pypykatz.registry.live_parserr} pypykatz.registry.offline_parserrgo_liver5rr[from_live_systemr{)r#r}rrur9r$r$r%get_prekeys_form_registry_lives$      z$DPAPI.get_prekeys_form_registry_livec Csrddlm}d}z |j|||d}Wnty+}z td|WYd}~nd}~ww|dur5||Std)r|rr~N)sam_path security_pathzX[DPAPI] Failed to obtain registry secrets via direct registry reading method. Reason: %sz [DPAPI] Registry parsing failed!)rr from_filesr5rerrorr{)r# system_pathrrrrur9r$r$r%get_prekeys_form_registry_filess  z%DPAPI.get_prekeys_form_registry_filesc sddlm}|fddjD}jD]t}j|jD]}td|jt |j |j |j<qj| D]O\ }}}}}} }}}} | dkrNq;j|jg}|D] } | dure|j| | dd|durwt|d krw|j| d|dqW| durt| d krd |jt | <q;qdS) z Parses the live LSASS process and extracts the plaintext masterkeys, and also generates prekeys from all available credentials It does not retun anything, just sets up all key material in the object return: None rpypykatzcsg|]}j|jqSr$)logon_sessionsr\).0r0katzr$r% *sz6DPAPI.get_all_keys_from_lsass_live..7[DPAPI] Got masterkey for GUID %s via live LSASS methoddpapiNr]r^ (r4)pypykatz.pypykatzrrr dpapi_credsrr[key_guidr6r7 masterkeyr to_grep_rowslowerr\rhlenr) r#rsidsr0dcpackage_nthexlmhexshahex plaintextr\r$rr%get_all_keys_from_lsass_live"s,  & z"DPAPI.get_all_keys_from_lsass_livecCs\ddlm}|}|jD]}|j|jD]}td|jt |j |j |j<qq |j S)zs Parses the live LSASS process and extracts the plaintext masterkeys return: dictionary of guid->keybytes rrr) rrrrrrr[rr6r7rr )r#rrr0rr$r$r%get_masterkeys_from_lsass_live>s  z$DPAPI.get_masterkeys_from_lsass_livec Cs ddlm}||}|jD]}|j|jD]}td|jt |j |j |j<qq|j| D]O\ }}}}} } }}}} | dkrFq3|j|jg} | D] } | dur]|j| | dd|durot|dkro|j| d|dqO| durt| dkrd |jt | <q3|j S) z Parses the mindiump of an LSASS process file and extracts the plaintext masterkeys file_path: path to the mindiump file return: dictionary of guid->keybytes rrz;[DPAPI] Got masterkey for GUID %s via minidump LSASS methodrNrrrr4)rrparse_minidump_filerrrr[rr6r7rr rrr\rhrr)r# file_pathrrr0rrrrrrrrr\r$r$r%get_masterkeys_from_lsass_dumpMs*   & z$DPAPI.get_masterkeys_from_lsass_dumpc Cst|d }|}Wdn1swYt|}|jj}t|}| |dddt }|dd} | |j |j <|j S)zM Decrypting the masterkeyfile using the domain backup key in .pvk format r>NH) r-rBr from_bytes domainkeyryr from_fileget_keydecryptrr rD) r#mkffilepvkfilefprOmkfdkprivkeydecdkryr$r$r%decrypt_masterkey_file_with_pvkks     z%DPAPI.decrypt_masterkey_file_with_pvkcCsdt|d#}|j||d\}}|j||j|||fWdS1s+wYdS)z Decrypts Masterkeyfile file_path: path to Masterkeyfile key: raw bytes of the decryption key. If not supplied the function will look for keys already cached in the DPAPI object. returns: CREDENTIAL_BLOB object r>)r:N)r-decrypt_masterkey_bytesrBr update)r#rr:r1mksbksr$r$r%decrypt_masterkey_fileys   $zDPAPI.decrypt_masterkey_fileT ignore_errorsc Cstjtj|dddD]1}tj|r=z||Wq ty<}z|dur)|td||fWYd}~q d}~wwq |j S)z Decrypts all Masterkeyfiles in a directory directory: path to directory ignore_errors: if set to True, the function will not raise exceptions if a file cannot be decrypted returns: dictionary of guid->keybytes **T recursiveFzFailed to decrypt %s Reason: %sN) globospathjoinisfilerr5rr[r )r# directoryrr/r9r$r$r%decrypt_masterkey_directorys z!DPAPI.decrypt_masterkey_directorycCsNt|}i}i}|jdurY|j|jvr|j|j||j<n;|jD] }|j|}|rAtd| ||j|j<|||j<nq!|durY|j|}|rY||j|j<|||j<|j dur|j|jvrq|j|j||j<||fS|jD]}|j |}|r||j |j<|||j<nqt|dur|j |}|r||j|j<|||j<||fS)z Decrypts Masterkeyfile bytes data: bytearray of the masterkeyfile key: bytes describing the key used for decryption returns: touple of dictionaries. [0] - > masterkey[guid] = key, [1] - > backupkey[guid] = key Nzuser key win: %s) rrrrDr rrrr[r, backupkeyr!)r#rOr:rrrrndec_keyr$r$r%rsH                  zDPAPI.decrypt_masterkey_bytescC<t|d}||WdS1swYdS)zc Decrypts CredentialFile file_path: path to CredentialFile returns: CREDENTIAL_BLOB object r>N)r-decrypt_credential_bytesrBr#rr1r$r$r%decrypt_credential_files  $zDPAPI.decrypt_credential_filecCs |j|jvr td|j|jS)z{ Looks up the masterkey for a given DPAPI_BLOB object blob: DPAPI_BLOB object returns: bytes of the decryption key z-No matching masterkey was found for the blob!)masterkey_guidr r5)r#blobr$r$r%get_key_for_blobs  zDPAPI.get_key_for_blobcCs(t|}|j|j|d}t|}|S)ad Decrypts CredentialFile bytes CredentialFile holds one DPAPI blob, so the decryption is straightforward, and it also has a known structure for the cleartext. Pay attention that the resulting CREDENTIAL_BLOB strucutre's fields can hold the secrets in wierd filenames like "unknown" data: CredentialFile bytes returns: CREDENTIAL_BLOB object entropy)rrdecrypt_blob_bytesrOr)r#rOrcreddec_datacbr$r$r%rs  zDPAPI.decrypt_credential_bytescCsL|durtd|j|j|jvrtd|j|j|j}|j||dS)a Decrypts a DPAPI_BLOB object The DPAPI blob has a GUID attributes which indicates the masterkey to be used, also it has integrity check bytes so it is possible to tell is decryption was sucsessfull. dpapi_blob: DPAPI_BLOB object key: raw bytes of the decryption key. If not supplied the function will look for keys already cached in the DPAPI object. returns: bytes of the cleartext data Nz+[DPAPI] Looking for master key with GUID %szANo matching masterkey was found for the blob! Looking for GUID %sr)rr[rr r5r)r# dpapi_blobr:rr$r$r% decrypt_blobs    zDPAPI.decrypt_blobcCsF|jdurddlm}||St|}tt||j|||dS)zc Decrypts DPAPI_BLOB bytes. data: DPAPI_BLOB bytes returns: bytes of the cleartext data Tr)CryptUnprotectData)r:r) r!pypykatz.dpapi.functiondefs.dpapirr rrr[rUr)r#rOr:rrrr$r$r%rs   zDPAPI.decrypt_blob_bytescCr)z Decrypts a VCRD file Location: %APPDATA%\Local\Microsoft\Vault\%GUID%\<>.vcrd file_path: path to the vcrd file returns: dictionary of attrbitues as key, and a list of possible decrypted data r>N)r-decrypt_vcrd_bytesrBrr$r$r%decrypt_vcrd_files  $zDPAPI.decrypt_vcrd_filecCt|}||S)z Decrypts VCRD file bytes. data: VCRD file bytes returns: dictionary of attrbitues as key, and a list of possible decrypted data )r r decrypt_vcrd)r#rOvvr$r$r%rs  zDPAPI.decrypt_vcrd_bytescCsXdd}i}t|jD]\}}|jD]}|||}||vr!g||<|||qq |S)a Decrypts the attributes found in a VCRD object, and returns the cleartext data candidates A VCRD file can have a lot of stored credentials inside, most of them with custom data strucutre It is not possible to tell if the decryption was sucsesssfull, so treat the result accordingly vcrd: VAULT_VCRD object key: bytes of the decryption key. optional. If not supplied the function will look for stored keys. returns: dictionary of attrbitues as key, and a list of possible decrypted data cSsD|jdur |jdurt|t|j}nt|td}||j}|SdS)Ns)rOivrrr)attrr:cipher cleartextr$r$r% decrypt_attr(s    z(DPAPI.decrypt_vcrd..decrypt_attr) enumerater" attributesrp)r#vcrdrresir:rrr$r$r%rs    zDPAPI.decrypt_vcrdcCs\t|}|j|j|d}t|}|j|j|j|j |j|j fS)z Decrypts the VPOL file, and returns the two keys' bytes A VPOL file stores two encryption keys. data: bytes of the VPOL file returns touple of bytes, describing two keys r) r rrblobdatar r"rpr`rra)r#rOrvpolrkeysr$r$r%decrypt_vpol_bytes;s  zDPAPI.decrypt_vpol_bytescCr)z Decrypts a VPOL file Location: %APPDATA%\Local\Microsoft\Vault\%GUID%\<>.vpol file_path: path to the vcrd file keys: Optional. returns: touple of bytes, describing two keys r>N)r-rrBrr$r$r%decrypt_vpol_fileMs $zDPAPI.decrypt_vpol_filecCs|j||dS)Nr)r)r#rOrr$r$r%decrypt_securestring_bytesYsz DPAPI.decrypt_securestring_bytescCs|t|Sr)rr6r7)r#hex_strr$r$r%decrypt_securestring_hex\szDPAPI.decrypt_securestring_hexcCs<t|d }|}Wdn1swY||S)Nr3)r-rBr)r#rr1rOr$r$r%decrypt_securestring_file_s   zDPAPI.decrypt_securestring_filecCst}t}t||Sr)rget_windows_dir_liveget_users_dir_livefind_masterkey_files_offline) windows_loc user_folderr$r$r%find_masterkey_files_livees zDPAPI.find_masterkey_files_livec sfdd}i}tjtj|ddddddD]|dur-td |t<qi}tjtj|d d dD] tjrHd |<q.is_guidSystem32 MicrosoftProtectrTrzGUID SYSTEM FILE: %s*Fr4LocalRoamingLocalLowAppDatazGUID USER FILE: %s) rrrrrr[rrisdir) users_path windows_pathrmasterkey_files user_folders subfolderrr$rr%rls,  "  $ z"DPAPI.find_masterkey_files_offlinecCs6tjd}tjd}tjd}|dt| S)NUSERNAME USERPROFILE)renvirongetr)usernameuserprofile_locr$r$r%rs   zDPAPI.get_users_dir_livecCs tjdS)N SystemRootrrrr$r$r$r%rs zDPAPI.get_windows_dir_livecCstjddS)N SystemDriverrr$r$r$r%get_windows_drive_liveszDPAPI.get_windows_drive_livecCttSr)r!find_chrome_database_file_offlinerr$r$r$r%find_chrome_database_file_livez$DPAPI.find_chrome_database_file_livec Csdi}i}tjtj|dddD]}tj|r,t|}||vr%g||<|||qdD]}dD]{}|D]v}||vrAi||<||D]g}tj|d||ddd d }tj|d uri|||d <t d |tj|d||ddd d} tj| d ur| ||d<t d| tj|d||ddd} tj| d ur| ||d<t d| qEq7q3q/|S)NrFrr )r(Googler Chromez User DataDefaultz Login DataT logindatazCHROME LOGINS DB FILE: %sCookiescookieszCHROME COOKIES DB FILE: %sz Local State localstatezCHROME localstate FILE: %s) rrrrrrrrprrr[) rdb_pathsrr/r subfolder_1 subfolder_2rdb_pathdb_cookies_pathlocalstate_pathr$r$r%rs@      z'DPAPI.find_chrome_database_file_offlinec Csri}g|d<g|d<g|d<z t|}|}Wnty4}ztd||WYd}~Sd}~ww|dkrxz|dWnty_}ztd||f|WYd}~Sd}~ww|D]\}}}} |d |||| fqd|S|dkrz|dWnty}ztd||f|WYd}~Sd}~ww|D]\} } } |d | | | fq|S) Nloginsr'r(z Failed to open chrome DB file %sz9SELECT host_key, name, path, encrypted_value FROM cookiesz4Failed perform query on chrome DB file %s Reason: %sr%z=SELECT action_url, username_value, password_value FROM logins) sqlite3connectcursorr5rr[rexecutefetchallrp) r,dbtyperesultsconnr2r9host_keynamerencrypted_valueurlrvenc_pwr$r$r%get_chrome_encrypted_secretsD    z!DPAPI.get_chrome_encrypted_secretcCst}||Sr)rr decrypt_all_chrome)r#dbpathsr$r$r%decrypt_all_chrome_lives zDPAPI.decrypt_all_chrome_livec Csi}g|d<g|d<g|d<d}|D]5}d||vr[t||dd}t|dd}t|}Wdn1s=wYz ||dd}Wn |d urYtd Yqd||vrt||dd}|dD]r\} } } } | d r| d d } | d d}| dd}t |t | dd}| |d|}|d ||d| | | |f|d td| | | |qo| r|| }|d ||d| | | |f|d td| | | |qod||vrHt||dd}|dD]P\}}}| d r3|d d } |d d}|dd}t |t | dd}| |d|}|d ||d|||fq||}|d ||d|||fqq|S)Nr/r' fmtcookiesr(r3os_crypt encrypted_keyTzLocalState decryption failed!sv10ir?)IV segment_sizezhttps://r%)r-rJloadbase64 b64decoderr5rr= startswithrrrrpcookieformatter)r#r?throwr6localstate_decrr1rCrrr8r9rr:nonce ciphertexttagrdec_valr;rv enc_passwordr]r$r$r%r>s^                   zDPAPI.decrypt_all_chromec Csz|Wn tdYz|Wnty-}z tdWYd}~nd}~wwt}|D]9}td|||f|||\}}t|dksVt|dkrbtd|||fq4td|||fq4|j |j fS)Nz,Failed to get masterkeys/prekeys from LSASS!z/Failed to get masterkeys/prekeys from registry!z3Decrypting masterkeyfile with guid: %s location: %srz2Decrypted masterkeyfile with guid: %s location: %sz:Failed to decrypt masterkeyfile with guid: %s location: %s) rrr[rr5rrrrr r!)r#r9mkfilesrDmkbkr$r$r%get_all_masterkeys_live%s$    zDPAPI.get_all_masterkeys_livecCsli}t|}|}|D]&}|jdr|j|d<q |jdr3|D] }|jdr2|j|d<q%q |S)Nz}namer9z}MSMz }keyMaterialenckey)ETparsegetrootrSendswithtextiter)filepathwifitreerootchildpcr$r$r%parse_wifi_config_file;s       zDPAPI.parse_wifi_config_filecCs>g}tj|dddD]}|drt|}||q |S)Nz6:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\**Trz.xml)rr^rrgrp)system_drive_letterwifisr/rbr$r$r%get_all_wifi_settings_offlineJs   z#DPAPI.get_all_wifi_settings_offlinecCrr)rrjrr$r$r$r%get_all_wifi_settings_liveSr!z DPAPI.get_all_wifi_settings_liver]cCsL|durdn|}|dkr|t|d7}|S|t|d7}|S)zaThis function generates the "extra" entropy based on the password and the provided entropy (opt).NrIrlz utf-16-le)rrWrXr)r]rdtyperr$r$r% strongentropyWs zDPAPI.strongentropyc csnt}z-z|Wnty}ztd|d}~wwtD]}||Vq"W|dS|w)NzrYrgrjrkrUrnrtrprvrNrrrr$r$r$r%rhs     -"   1       !     " & 5      rcCsnt}|dur |||dur||d|vr|d|vr)d|vr)|d|vr5d|vr5||S)Nallregistrylsass)rrPr<rYrr)methodsrpkfrr$r$r%prepare_dpapi_lives  rcCsd}d}t}|||dS)NzN/mnt/hgfs/!SHARED/feature/masterkeyfile - 170d0d57-e0ae-4877-bab6-6f5af49d3e8eza/mnt/hgfs/!SHARED/feature/pvkfile - ntds_capi_0_fdf0c850-73d3-48cf-86b6-6beb609206c3.keyx.rsa.pvk)rdecrypt_mkf_with_pvk)rrrr$r$r%mainsr__main__);rrrJrYrr0rKplatformhashlibrrrxml.etree.ElementTreeetree ElementTreer[rr'pypykatz.dpapi.structures.masterkeyfiler(pypykatz.dpapi.structures.credentialfilerrpypykatz.dpapi.structures.blobr pypykatz.dpapi.structures.vaultr r r pypykatz.dpapi.finders.ngcr r!pypykatz.dpapi.finders.cryptokeysrunicrypto.hashlibrrVunicrypto.symmetricrrrwinacl.dtyp.wcee.pvkfilerwinacl.dtyp.wcee.cryptoapikeyrrpypykatz.commons.commonrr1cryptography.hazmat.primitives.asymmetric.paddingrsystemr*pypykatz.commons.winapi.processmanipulatorrrrrrr$r$r$r%sL         ;U